diff options
| author | Jakub Kicinski <[email protected]> | 2023-10-10 17:36:51 +0000 |
|---|---|---|
| committer | Jakub Kicinski <[email protected]> | 2023-10-12 00:24:46 +0000 |
| commit | 71c299c711d1f44f0bf04f1fea66baad565240f1 (patch) | |
| tree | 700a909d805b731d7e107a8ee6b2a5e2ed25a9c4 /net/ipv4/tcp_output.c | |
| parent | Merge tag 'ieee802154-for-net-2023-10-10' of git://git.kernel.org/pub/scm/lin... (diff) | |
| download | kernel-71c299c711d1f44f0bf04f1fea66baad565240f1.tar.gz kernel-71c299c711d1f44f0bf04f1fea66baad565240f1.zip | |
net: tcp: fix crashes trying to free half-baked MTU probes
tcp_stream_alloc_skb() initializes the skb to use tcp_tsorted_anchor
which is a union with the destructor. We need to clean that
TCP-iness up before freeing.
Fixes: 736013292e3c ("tcp: let tcp_mtu_probe() build headless packets")
Reviewed-by: Eric Dumazet <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Jakub Kicinski <[email protected]>
Diffstat (limited to 'net/ipv4/tcp_output.c')
| -rw-r--r-- | net/ipv4/tcp_output.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c index aa0fc8c766e5..9c8c42c280b7 100644 --- a/net/ipv4/tcp_output.c +++ b/net/ipv4/tcp_output.c @@ -2456,6 +2456,7 @@ static int tcp_mtu_probe(struct sock *sk) /* build the payload, and be prepared to abort if this fails. */ if (tcp_clone_payload(sk, nskb, probe_size)) { + tcp_skb_tsorted_anchor_cleanup(nskb); consume_skb(nskb); return -1; } |